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Executive summary 


Audit Methodology 


The Information Commissioner is responsible for enforcing and promoting compliance with data protection 
legislation, as well as the Freedom of Information Act 2000 (FOIA) and Environmental Information Regulations (EIR). 
Section 47 of the FOIA provides provision for the Commissioner to assess whether a public authority is following 
good practice, including compliance with the requirements of this Act and the provisions of the codes of practice 
under sections 45 and 46. The ICO sees auditing as a constructive process with real benefits for controllers and so 
aims to establish a participative approach. 


The purpose of the audit is to provide the Information Commissioner and South Yorkshire Police (SYP) with an 
independent assurance of the extent to which the information handling practices of SYP, within the scope of this 
agreed audit, conform with the codes of practice under sections 45 and 46 of the FOIA. 


SYP agreed to a consensual audit by the ICO of its compliance with the FOIA. An introductory telephone meeting 
was held on 6 June 2023 with representatives of SYP to discuss the scope of the audit. 


It was agreed that the audit would focus on the following area: 


Freedom of Information The extent to which the information handling practices of SYP, within the scope of this 
(FOI) agreed audit, conform with the codes of practice under sections 45 and 46 of the FOIA. 
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Audits are conducted following the Information Commissioner’s audit methodology. The key elements of this are a 
desk-based review of selected policies and procedures, on-site visits including interviews with selected staff, and 
an inspection of selected records. 


Where weaknesses were identified recommendations have been made, primarily around enhancing existing 
processes to facilitate compliance with freedom of information legislation. In order to assist SYP in implementing 
the recommendations each has been assigned a priority rating based upon the risks that they are intended to 
address. The ratings are assigned based upon the ICO’s assessment of the risks involved. SYP’s priorities and risk 
appetite may vary and, therefore, they should undertake their own assessments of the risks identified. 


Audit Summary 


Freedom of Information There is a limited level of assurance that processes and procedures are 


delivering freedom of information compliance. The audit has identified 
considerable scope for improvement in existing arrangements to 
reduce the risk of non-compliance with freedom of information 
legislation. 
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Priority Recommendations 


Breakdown of priority recommendations 


m Medium 
m High 
E Urgent 


Freedom of Information 


A bar chart showing a breakdown of the priorities assigned to the recommendations made. 
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Areas for Improvement 


e Compliance with responding to FOI requests within the statutory timeline was low at the time of the audit and 
local reports do not potentially show complete compliance details. An exacerbating factor to low compliance is 
that staffing levels are not currently appropriate to the volume of requests received. 


e Information Asset Owners (IAOs) are tasked with adopting a strategic role for data governance across their 
respective department. Their ongoing reporting to SYP’s most senior data board, chaired by the Senior 
Information Risk Owner (SIRO), was not however demonstrated to be fully embedded. This risks both the SIRO 
not receiving complete information about data governance and FOI compliance across SYP, and IAOs not being 
held to account for data and FOI compliance in their respective departments. 


e FOI awareness is not included in all staff training. 
e Whilst it was demonstrated that staff apply diligence and seek guidance appropriately when handling requests, 
there was not a high level of awareness of the formalised national and local FOI written policies and instructions 


nor of the relevant Codes of Practice. 


e SYP's publication scheme does not include all the information recommended by ICO guidance. 
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Disclaimer 
The matters arising in this report are only those that came to our attention during the course of the audit and are 
not necessarily a comprehensive statement of all the areas requiring improvement. 


The responsibility for ensuring that there are adequate risk management, governance and internal control 
arrangements in place rest with the management of South Yorkshire Police. 


We take all reasonable care to ensure that our audit report is fair and accurate but cannot accept any liability to 
any person or organisation, including any third party, for any loss or damage suffered or costs incurred by it 
arising out of, or in connection with, the use of this report, however such loss or damage is caused. We cannot 
accept liability for loss occasioned to any person or organisation, including any third party, acting or refraining 
from acting as a result of any information contained in this report. 


This report is an exception report and is solely for the use of South Yorkshire Police. The scope areas and controls 
covered by the audit have been tailored to South Yorkshire Police and, as a result, the audit report is not intended 
to be used in comparison with other ICO audit reports. 
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